Judge orders Google to give up URLs, no search terms

Google scores a significant victory in its attempt to keep its index and users …

In his ruling last week, Judge James Ware indicated that he would require Google to turn over some of the data the US Department of Justice had requested, but did not say how much. On Friday, he issued his full order in which he detailed what exactly Google needs to turn over to the government.

Under terms of the order, Google will be required to turn over 50,000 random URLs from Google's index of web sites to the DoJ. However, the search giant will not be forced to turn over any of the 5,000 search queries the government requested. Originally, the DoJ wanted a random sampling of 1 million URLs from Google's index along with another 1 million search queries from a one-week period. The government's willingness to negotiate down to 50,000 URLs and 5,000 queries was a significant factor in the judge's decision to give the government "the benefit of the doubt."

At issue is the government's attempt to have the Child Online Protection Act restored in all of its glory. Originally designed to prevent children from accessing pornographic web sites, portions of the law were struck down by the Supreme Court in 2004. In its appeal of the Supreme Court's decision, the DoJ is arguing that when it comes to keeping kids away from Bad Stuff on the 'Net, the COPA is a better solution than web filtering software. The government hopes to use the data obtained from Google and the other search engines (the rest of which complied fully with the subpoenas) to buttress its argument.

The DoJ will have to make do without the search terms, as Judge Ware agreed with Google's arguments that the release of that data could compromise the company's trade secrets. More importantly, he found that providing sample search queries could result in a breach of privacy on the part of the users.

Although the Government has only requested the text strings entered (Subpoena at 4), basic identifiable information may be found in the text strings when users search for personal information such as their social security numbers or credit card numbers through Google in order to determine whether such information is available on the Internet. (Cutts Decl. ¶¶ 24-25.) The Court is also aware of so-called "vanity searches," where a user queries his or her own name perhaps with other information. Google's capacity to handle long complex search strings may prompt users to engage in such searches on Google. (Cutts Decl. ¶ 25.) Thus, while a user's search query reading "[user name] stanford glee club" may not raise serious privacy concerns, a user's search for "[user name] third trimester abortion san jose," may raise certain privacy issues as of yet unaddressed by the parties' papers. This concern, combined with the prevalence of Internet searches for sexually explicit material (Supp. Stark Decl. ¶ 4) --generally not information that anyone wishes to reveal publicly --gives this Court pause as to whether the search queries themselves may constitute potentially sensitive information.

According to a post on the official Google corporate blog, the company is quite satisfied with the ruling and plans to fully comply. It's a ruling that Google says is a "clear victory" for its users and one that it believes will help the public remain confident that it takes users' privacy very seriously.

Naturally, Google—and other search engines—will be subject to similar subpoenas down the road and may be forced to hand over more identifiable data in the future. Some analysts believe that the government sought the information that it did to establish a precedent for future requests, especially since it's not clear how obtaining the data from Google as opposed to doing its own is going to help the government build a case. At the very least, the ruling should raise the bar for such attempts in the future. But privacy advocates shouldn't be celebrating this victory too much. Remember that when it comes to the Internet, privacy is always relative.